Hi I need your help to crack this nut. An application is making logfiles in json format, with \n\r after each tag. The application doesn't log into a single file (eventlog.xml) and rollover. It write new logfiles every hour (eventlog_yyyy-mm-dd_hh.xml), if and only if new data is going to be logged. So if there has been no activity in a given hour that file will never be created.
Questions: 1. How should I configure the tail process? Should I use the multiple file mode? It is one application and on log file per hour, but how should I configure the rolling filename pattern and the start filename? 2. How do I combine all lines which belongs into the same event into a single flowfile. 3. How can I be sure that a tail doesn't read in the same time a log is being written, so the tail is only reading the half part of an event. In the case it happens, to be sure to combined first part of the event from one read with the next part in next read. Please help Kind regards Jens
